This easy to implement attack means that basically any ASP.NET application is vulnerable. Oops.

Demo of ASP.NET Padding Oracle Attack | threatpost.